By Ting-Fang Yen

Device fingerprinting – collecting information from a device for the purposes of identification – is one of the main techniques used by online services for fraud detection. The goal is to recognize “bad” devices used by fraudsters, such that they can be identified even when other attributes such as user names or IP addresses change.

In the browser era, device fingerprints typically took the form of browser and OS configuration information or persistent HTTP cookies. However, as more online services shift to a mobile-first or mobile-only strategy, device fingerprinting technology also took on an entirely new form.

The tracking entity – often the mobile application – now resides on the device itself, rather than remotely as in Web communications. It hence has access to mobile device identifiers, sensor readings and other contextual information that enable more accurate device fingerprints and, potentially, better fraud detection solutions.

FIGURE 1
Identifiers used in device fingerprinting: browser vs. mobile app

Compared to Web services, mobile apps reside on the device and hence have access to more fine-grained information for device fingerprinting.

This did not deter fraudsters. Device fingerprinting may be good at identifying known bad mobile devices, but there is little they can provide on never-before-seen devices that lack reputation history.

Fraudsters exploit this information void to their advantage.

By simulating the appearance of multiple distinct mobile devices, they can conduct large-scale attack campaigns that look as if they are from unique legitimate users. This allows them to avoid detection and reap gains from fraudulent transactions, ad campaigns and mass registered fake accounts, just to name a few.

Mobile device flashing

FIGURE 2
A common technique for simulating the appearance of multiple new, distinct mobile devices is called device flashing

On mobile devices, the operating system initializes and controls the system configuration. For legacy reasons, the operating system on mobile devices is sometimes also called “firmware” or “ROM image.”

By “flashing,” or overwriting, the current version of the operating system with a custom version, it is possible to reset the device to its factory state. This effectively erases all stored data, and forces a new device identifier to be generated.

For example, ANDROID_ID, the unique identifier for Android phones, is randomly generated when the user initializes the device.

Recently, our team observed mobile device flashing used in an attack to perform fraudulent purchases within a popular mobile game app.

The fraudsters acted as “brokers” to purchase virtual items on the gamers’ behalf, leveraging stolen credit cards and virtual currency arbitrage to make a profit.

Device flashing is used here to avoid raising suspicion from having too many accounts (the gamer accounts) associated with the same device (the fraudster “broker’s” phone).

The table below shows this attack in action.

Each row corresponds to an event logged by the mobile game app. The attacker repeatedly logged on as different users (gamer IDs) to make purchases, without generating any other types of events indicative of actual game play.

As shown in the “DEVICE_ID” column, they also switched out their device identifiers frequently – after every couple of users – such that each “device” will only be used by a very small number of users, similar to legitimate devices.

FIGURE 3
An anonymized example of device flashing used in fraudulent in-app purchases within a mobile game app

Spoofing via intercepting system calls
In addition to mobile device flashing, spoofing is another way of simulating the appearance of multiple devices. This abuses the fact that apps obtain device identifiers and other system information through system calls.

On jail-broken/rooted devices, or for apps that have been maliciously repackaged, these calls can be intercepted and given a fake value – whether it is device identifiers, sensor readings or any other contextual information about the device’s surroundings.

As an example of spoofed identifiers, the figure below shows invalid “MAC addresses” observed by a mobile app that are not even in hexadecimal representation, which is a base 16 system that should only contain the symbols 0-9 and A-F (or a-f).

FIGURE 4
Examples of fake MAC addresses observed by a mobile app. These invalid MAC address contain non-hexadecimal characters

The table below shows examples of fake signup events at an online social network app, which offers newly registered users a limited number of virtual currency that they can use to purchase virtual items or trade with other users.

In this attack, hundreds of users registered from the same IP subnet, each with a different MAC address and randomly generated usernames.

By mass registering fake accounts this way, the attackers can harvest virtual currency to resell for profit, all while evading standard detection techniques based on unique device identifiers.

FIGURE 5
An anonymized example of device ID spoofing used to sign up fake accounts at a social network mobile app

Uses and limits of mobile device fingerprinting
Device fingerprinting technology has advanced greatly in the mobile era, primarily due to the many fine-grained “identifiers” available on mobile devices that were not previously accessible on PCs.

However, as we show in the above examples, fraudsters have adapted their techniques to circumvent mobile device fingerprinting and the security solutions that rely on them.

With these sophisticated obfuscation techniques, a group of bot accounts controlled by the same attackers can appear to originate individually from different devices and geolocations, just like legitimate users.

More importantly, these attacks illustrate the importance of understanding the caveats and limitations of mobile device fingerprinting.

UNIQUE IDENTIFIERS may not always be what they seem, and even then, recognizing a returning device is not the same as identifying fraud.

As the security landscape continues to evolve with new technology, online services also need to be aware of these new threats and be prepared to deal with them.

Ting-Fang Yen is research scientist at DataVisor, Mountain View, CA. Reach her at [email protected].